2026 Icon Oncology Group — supplier-system breach; patient correspondence (Australia)
Data compromised
Company: some patient information on supplier system; believes discrete business-correspondence documents rather than complete patient files; Australia-only at notice; Group systems secure / care unaffected. Actor claim (unverified census): >31,000 documents including names, addresses, diagnoses, Medicare details — recordsAffected uses actor document count pending company census.
Technical writeup
Verified Icon Oncology Group notice (12 Oct 2026, updated 3:15pm AEST). Unauthorized access to some patient information on a supplier system; appears Australia-only. IR activated; access reset; forensic advisers; AFP and regulators notified; obtained copy of impacted records; will contact patients and treating doctors. Believes discrete correspondence docs, not complete patient files; Group systems secure; care unaffected. CyberDaily reports forum actor “2019” offered >31k documents allegedly from a supplier. companyConfirmed true; recordsAffected 31000 (actor document claim used pending company headcount).
Root cause
Unauthorized access to some patient information held on a supplier’s system (Icon Oncology Group notice 12 Oct 2026); forum actor “2019” separately claimed ~31k+ documents for sale